$ the-wire · showcase
sandbox-runtime tightens read denies and cleans up mounts
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
2 people shipped this
anthropics/sandbox-runtime shipped a batch of fixes that make its own sandbox boundaries hold where they previously leaked: glob deny patterns on type-less filesystems, credential denies separated from generic read denies, and mount points and temp objects released when sandboxes end
Glob walk: ask for the type of an entry that was listed without one anthropics/sandbox-runtime
On filesystems that list directory entries without their types (some NFS and FUSE mounts, XFS with ftype=0), every type probe answered false, so the glob walk skipped the entry entirely and never recorded it: a denyRead pattern like <data>/**/.env matched <data>/.env but silently let <data>/x/.env and <data>/x/deep/.env be read. The walk now asks for the entry type when the listing did not supp...
Read config: carry credential denies apart from denyRead anthropics/sandbox-runtime
FsReadRestrictionConfig now carries credentialDenyOnly (the denyOnly entries that came from credentials.files) and ownAllowWithinDeny (the files the library adds itself: the trust bundle, the CA certificate, the JVM proxy agent). Both are subsets of lists that already existed and stay absent when empty, and denyOnly and allowWithinDeny keep their content and order, so existing configs need no e...
Warn when the library is installed where a sandboxed command can write it anthropics/sandbox-runtime
The library now warns when it is installed somewhere a sandboxed command can write it: as a dependency it lives in <project>/node_modules/, usually inside allowWrite, so a sandboxed command can rewrite it and the next srt run in that project executes the result unsandboxed. An earlier attempt on the same branch write-denied the library's own files; that made every sandboxed npm install fail on ...
Remove the library's temp objects at exit, and after an initialize() that fails (#670) anthropics/sandbox-runtime
Temp objects the library creates are now removed at exit and after an initialize() that fails, so a failed startup no longer leaves them behind. Sandboxes that throw during init previously accumulated leftovers; now they do not.
linux: remove mount points when the last sandbox is done (#671) anthropics/sandbox-runtime
On Linux, mount points are torn down when the last sandbox finishes rather than persisting. If you run many short-lived sandboxes on one host, mount state no longer accumulates across runs.
test: add streaming coverage for per-tool rails NVIDIA-NeMo/Guardrails
Streaming coverage was extended for per-tool regex rails: a test where only the second of two streamed tool calls matches (the stream is blocked with one tool_output_rails violation and no tool call leaks), one where two clean calls stream through in order, and a new TestStreamingPerToolResultRegex for streamed tool results. For operators this is confirmation that per-tool rails hold under stre...
